Posted
by
timothy
on Thursday October 23, 2014 @07:44AM
from the draconian-by-example dept.

An anonymous reader writes with this excerpt from The Guardian: Government plans that mean computer users deemed to have damaged national security, the economy or the environment will face a life sentence have been criticised by experts who warn that the new law could be used to target legitimate whistleblowers. The proposed legislation would mean that any British person deemed to have carried out an unauthorised act on a computer that resulted in damage to human welfare, the environment, the economy or national security in any country would face a possible life sentence. Last week the Joint Committee on Human Rights raised concerns about the proposals and the scope of such legislation.

Government plans that mean computer users deemed to have damaged national security, the economy or the environment will face a life sentence have been criticised by experts who warn that the new law could be used to target legitimate whistleblowers.

Could be? Come on - targeting whistleblowers is the point. It's not about damaging national security, the economy or the environment - it's about damaging somebody's political career.

IN old england, the prisons became so over crowded they started using the rotting hulks of navy ships as prisons and as that became full they resorted to "transportation" which basically meant you get a one way ticket to help settle australia. (see book "the Fatal Shore"). Now that mars transport is about to approach feasibility ans Elon Musk says we need vast numbers of people for sustainable living I'm shocked the UK govt isn't sentencing these hackers to Transportation.

Good point.
I'm actually, seriously, convincedly, for it, and you can quote me on it. 'Force Majeure' -- in the interest of The People of the country, to save the country, its intrinsic values and such as ar laid out in their fundamental societal documents, so to speak; I bet the Constitution of many a so-called Western Democratic State would provide for something like that.

Instead of ending a politician's career, end his life. The penalty is the same, so why bother with the lesser crime?

This actually happened with road thieves, and is usually studied when you study law: overly harsh punishments result in an increase in the severity of crimes committed.

The short version: they raised the punishment for theft on the roads to almost death (gruesome mutilation, not death, but close), and the robbers started killing witnesses rather than risk being identified. Clearly, stopping their illicit activities isn't an option for them, be it for whatever reason.

Because you'll never get near them to do the deed. Maybe you'll get some of the low level workaday guys that don't matter. But any of the people really making your life hell are very, very well protected.

Government plans that mean computer users deemed to have damaged national security, the economy or the environment will face a life sentence have been criticized by experts who warn that the new law could be used to target legitimate whistleblowers.

Could be? Come on - targeting whistleblowers is the point. It's not about damaging national security, the economy or the environment - it's about damaging somebody's political career.

Looks to me like the UK is threatening the US Department of Justice employees who have been hacking Facebook accounts with life in prison for damaging the feelings of security of the whole world and the environment of trust of Facebook. It's also going to target large corporations that are doing propaganda concerning pollution or global warming, as these things damage the environment. And the bankers, don't forget about the bankers.

Haha, just kidding like you said this looks like its aimed at whistleblowers

If you attack an industrial system at a utility and make a bunch of people sick or die, even if it was "unintentional" you should get life. Why? You had no damn business being there. Even if you're an aspie with boundless curiosity, there has to be a consequence for breaking into sensitive systems and inflicting real, measurable harm to the public.

This kind of legislation would apply even if nobody died in the carrying out of the activity.

And there's nothing wrong with punishment without someone dying. If someone destroyed your car (physically or digitally) there is harm done to your wallet regardless. Of course as has been said repeatedly it is not yours nor my wallet/life/<important thing here> this is aimed at protecting.

I was thinking more along the lines of something like having the convicted party drawn and quartered, staked out on an ant hill (fire ants preferably), garroted, etc. The potential punishment needs to be a real deterrent; not whiling away the years in some minimum security resort.

/. groupthink seems to have focused on the "heroic hacker" unearthing politically embarrassing scandals while forgetting the damage that everyone from site taggers who get carried away to what common criminals, terrorists and sta

If you attack an industrial system at a utility and make a bunch of people sick or die, even if it was "unintentional" you should get life

...and you almost certainly would, with no changes required to current law. Well...I don't know about the UK, but in the USA if you cause the death of another human being, that's homicide. There's a spectrum from Involuntary Manslaughter up to Premeditated Murder. Using a poison or a machine to do it doesn't change anything.

So you can get rid of the "injuring people" argument. This law would only change what happens when nobody is physically harmed.

So hypothetically lets say aunt Tilly uses decides to use their online form to post a question to customer service. She is feeling cute and copy pastes an emoticon which her browser software decides to accomplish by inserting an img tag.

The free emoticon side Tilly users happens to be some other attacker's plot to get people to send his Cross site request forgery links for him. Tilly has idea some nasty java script is about turn her cute little links to some smily.gif into the password requests for 50 pop

The attacker is already established by precedent. Most crimes have a "Mens rea" requirement - an intent to commit the crime. Aunt Tilly didn't have any intent so she's not guilty. The person who created the emoticon hack was intending to do commit a crime.

The victim is anyone who suffered loss. The company and anyone whose password was stolen in this case.

Yes that is why I asked if the requirement was more than negligent. Negligent basically means you formed no intent; specifically you did not for see the particular consequences of your actions or possibly inaction.

Consider this, suppose I buy some candy out of the back of some guys white van in parking lot. I bring it into the kids preschool for snack. All the kids die. I would totally be up for manslaughter. The mens rea would be negligent. I was just being a cheap bastard, did not mean anyone any

Most crimes have a "Mens rea" requirement - an intent to commit the crime.

Unfortunately, most of the time the law is actually enforced such that merely intending to commit the act that turns out to be prohibited by law is considered "intending to commit the crime".

As an example, driving 55mph in a 35mph zone can be punished regardless of whether you intended to drive over the speed limit. Likewise, breaking some obscure law can still be punished even if you didn't realize what you were doing was a crime. So, if Aunt Tilly intended to send that emoticon, then she can be prosecut

Speeding is different. It's a strict liability crime. You are charged whether you know you're speeding or not.

Not knowing it's a crime is not a defence. However, not knowing that you're even doing the act is a defence. Aunt Tilley had no way of knowing that the emoticon was infected, so she's not guilty. If she did know it was infected but was not aware that infecting someone's computer with a trojan was a crime then she would be guilty.

So, if Aunt Tilly intended to send that emoticon, then she can be prosecuted regardless of whether she intended harm. As the GP noted, she likely wouldn't be, but someone not as sympathetic might be.

Unless, of course, Aunt Tilly got busted for pot once back in the 70's. Then the media will prattle on about how she has an "existing criminal record" and convince the unwashed masses she's a filthy criminal not worthy of compassion.

Oh right, because your government has laws that remove a person's right to speech if said government deems said speech to have some vaguely negative effect on something, somewhere. So basically the only information the public recieves regarding ongoing issues is the nicely scrubbed, sanitized version approved by TPTB.

I prefer our way, thanks. Much better to receive the info and make my own informed judgement. Besides, 'trial by media' is only really an issue because of stupid people who believe everything t

Oh right, because your government has laws that remove a person's right to speech if said government deems said speech to have some vaguely negative effect on something, somewhere. So basically the only information the public recieves regarding ongoing issues is the nicely scrubbed, sanitized version approved by TPTB.

Not exactly. We have laws that consider rights exist outside of freedom of speech. The right to a fair trial is considered one of these rights.

If you attack an industrial system at a utility and make a bunch of people sick or die, even if it was "unintentional" you should get life.

If you attack an industrial system and people get sick or die as a result then there are already plenty of laws to punish you, up to and including the likes of manslaughter and murder. There is nothing special about doing so via computer and no additional laws are required, nor is any "zero tolerance" style life sentence just because computers were involved a useful addition to the statute books.

Even if you're an aspie with boundless curiosity, there has to be a consequence for breaking into sensitive systems and inflicting real, measurable harm to the public.

And there would be -- if, in the judgement of a competent court, there was in fact real, measurable harm caused t

I know this is a radical idea, and I'm just spitballing here, but maybe the part about unauthorized act being done a computer should be a hint. If it's not your computer or your system, don't try to get into it.

Or are we going to use excuses as to why it's acceptable to try and get into someone else's equipment when you're not supposed to then whine about the penalty when you're found out?

It's probably worth noting that in the UK a life sentence doesn't mean "life in prison", it means more likely about 15 years, though sometimes less. The soldier who murdered a wounded insurgent in Afghanistan for example only has a minimum of 10 years set.

Which isn't to say that's an acceptable punishment if this law is used against whistleblowers, but I figured it's worth making clear that life doesn't inherently mean whole life in the UK. Not even close in fact in the vast majority of cases - whole life i

I'm not sure really, if it was an employee it would've been criminal negligence but if someone isn't an employee or doesn't realise what they're doing? They could probably be charged for manslaughter but would a typical manslaughter case be sufficient enough punishment for many such deaths stemming from intentional meddling, but unintentional consequences? That's the problem I guess - computers create a level of indirection between the crime and the perpetrator and I don't think many pre-computer era laws r

The problems are its not always getting a shell. What if you violate a websites TOS, is that an unauthorized act?

What does damage national security mean, If I post about how Minister X lied about Y 10 years ago does that erode society's faith in its officials and by extension "threaten national security"?

There are bright lines such as bypassing an authentication mechanism; deliberate insertion of abnormally structured data designed to alter application behavior (injection attacks); that could be defined in laws like this. Its very possible to write laws governing computer access that are both inclusive to allow interpretations to cover changing and new technology and still be specific enough a reasonable people can agree on if a specific act meets the criteria.

Groups like OWASP have done the work; we now have good working definitions and generic criteria for describing attacks and abuse. Its not '92 anymore where public network access was a new thing.

There are two reasons overly broad laws like this are being written both equally scary. 1) The people writing and enacting them remain profoundly ignorant of topics that pretty much effect every aspect of the economy today. 2) They want them overly broad because it makes for a nice blunt instrument to shutdown anything that threatens the status quo.

deemed to have carried out an unauthorised act on a computer
I know this is a radical idea, and I'm just spitballing here, but maybe the part about unauthorized act being done a computer should be a hint. If it's not your computer or your system, don't try to get into it.

And what exactly happens when it is you who is wrongly accused of such a heinous crime against the State?

Seems everyone is looking over the worst part of this new suggested framework of life sentencing against "hackers". It's ripe for abuse to quickly get rid of the squeaky wheel or frame someone.

I know this is a radical idea, and I'm just spitballing here, but maybe the part about unauthorized act being done a computer should be a hint. If it's not your computer or your system, don't try to get into it.

Or are we going to use excuses as to why it's acceptable to try and get into someone else's equipment when you're not supposed to then whine about the penalty when you're found out?

This is as stupid as it ever was. "Don't do the crime if you can't do the time." utterly ignores the fact that people are discussing whether the punishment actually fits the crime. It's a useless response that adds absolutely nothing.

Prison should be about rehabilitation and justice, not barbaric revenge.

Eric Holder gave a televised interview in which he credited a whistle blower at a bank for allowing the bank executives to be held to account for their part in making money off liar's loans. The reporter missed the obvious follow-up question to Holder, "So whistleblowers are good?"

Not really the reporter knows everyone who cares enough to listen to anything holder says already is perfectly aware of the true answer to that question at least in Eric's opinion.

Whistle-blowers are great as long as they are embarrassing my political enemies, in which case I am thrilled to stand up for strong protections and will gladly come up with some elaborate construct to make it morally equivalent something people get whipped up about like civil rights or something. In all other cases I perceive them as threat as a threat to the status quo and my crony buddies; I'am prepared to invent some wild construct to tie it to "national security" because that way everything is "on the table", I don't mind sounding "insane" to anyone actually listening because my buddies will brand anyone listening as "insane".

This is the reason why totalitarianism eventually always collapses. It cannot sustain any kind of working economy. It gets pretty rough towards the end though, just look at Northern Korea. And it can take very, very long.

The problem with this law is that it will later be abused by whatever party or coalition is in power at the next election. Nobody has an issue with jailing people for life if they've intruded upon a secure network with the intent to cause damage or inconvenience, but the scope of the law's potential application is so broad it will ensare mostly innocuous behaviour if the government of the day decides it wants to be seen as tough on crime.

You gotta be kidding. Prison for life just for network intrusion? Most murders would warrant less than that. It's just another over the top law, like anti-blasphemy in Islam countries. No place for them in this century. Punishment must be according to the crime, and there's no way you could do something deserving a life sentence using computer hacking alone.

Nobody has an issue with jailing people for life if they've intruded upon a secure network with the intent to cause damage or inconvenience

Um... Sorry, but I for one have a big problem with that.

Leaving aside legitimate questions about the role of incarceration and its effectiveness as a deterrent and/or for rehabilitation of offenders, a life sentence is the kind of thing you hand down for premeditated murder, deliberately taking the life of another human being.

It is absurd to suggest that the same sanction should apply to someone who merely hacks some corporation's network and messes with the office printer in an irritating but otherwise harmless protest against some corporate policy. Such a law would imply that physically harmless hacking of some corporate or government entity is many times worse than rape, killing someone accidentally through dangerous driving, defrauding an individual of their life savings, and numerous other very personal and very damaging crimes.

Playing Devil's Advocate here (woohoo high score!). This law might get passed due to the ruling parties having a strong majority in the Parliament. Maybe a future UKIP party gets to power with a small minority and gets blocked repeatedly by the other parties combining against them - they'd easily be able to use this law to get rid of their opponents.

...any British person deemed to have carried out an unauthorised act on a computer that resulted in damage to human welfare, the environment, the economy or national security in any country would face a possible life sentence.

What about politicians that do the same thing? Oh, I guess that would an "authorized" act. Never mind.

[ Man, oh man, if we could jail politicians for damaging the economy, environment or human welfare here in the U.S....]

"damage to human welfare, the environment, the economy or national security in any country"

First note that it allows for damaging the national security in any country. So the UK is now the world police? Hey, I thought that was the USA's job! Also, does that mean they will protect ISIL? Or North Korea? Does that mean when the government of South Korea attempts to defend itself from a cyberattack from North Korea, they are violating the UK's law? It's damaging the National Security of North Korea by preventing them from undermining South Korea!

Human welfare, the environment, the economy or National security pretty much covers ANYTHING. And the word damage is similarly vague.

When I use Hack BP's computer and find out they are illegally dumping oil in Scotland, isn't that damaging the economy by revealing BP's crime?

When the FBI pretends to be a criminal on Facebook, isn't that damaging the 'welfare" of the human criminal?

This is a law designed to let the UK selectively arrest anyone who does anything on a computer that is 'unauthorised'.

This widens the legal basis to lock up most of the UK government, parliament and secret services for good, as well as many foreign (mostly US) government employees. When will the trials start?

Nope, all that is authorized so it doesn't fall under this law. It's kind of like how the US government defines terrorism as non-state actors using violence against the public for political gain. The key is "non-state". That way when the CIA uses a secret bombing campaign to turn the population of a foreign country against its leaders, it's not terrorism.

Just like there are different "levels" of theft and manslaughter/murder, there should be different levels of "damaging national security."

The penalty should be based on the harm done, the intent, and if applicable, the degree of recklessness.

Also, existing charges should be used instead of this charge where applicable. For example,if I harm national security with the intent of exposing someone to grave danger and they die as a result, then a murder or similar charge is more appropriate than a charge of "da

So if your boss and your bosses bosses are acting in ways that you deem inapropriate and in violation of their duties to the citizens of the UK you're better off killling them now than exposing them. You might get off in just a few years.

and one that should be avoided at all costs. If you live there, move before it is too late. Same applies to its little brother Australia. Not that the US is any great shakes either but we probably have another 10 to 20 years before sinking to the same depths.

Ok, the piece pointed to here paints a very narrow picture. Let's imagine a scenario whereby "cyber-attacker X" takes over an air-traffic control system and starts crashing planes for ransom. I can see the argument that that's a life-worthy crime. (not sure how "life" is defined) The devil is in the details.

Arguably, the act of attempting to log in to a computer causes that machine to use power that would have otherwise not been used. Generating power harms the environment (CO2 etc) so any login (failed or otherwise) to any computer (even your own!) may render you guilty.

Simplest would be to build a wall round the entire British Isles and redefine it as a prison...

A law that sweeping surely is the result of law makers having a fit of temper. And it is senseless. Put it on a scale with someone like George w. Bush who helped wreck millions of lives with ignorant political behaviour and ruined America's world image with the torture of POWs. Look at the harm that fool did and he was not punished one bit. Then consider the harm that ronald reagen did with the whacked out notion of trickle down economics and all the harm that was done. Or consider Richard Nixo

Generally in my state (SC), murderers get life or the chair. And there's a good chance the jury you end up with would have a combined IQ somewhere around 82 and will assume you are guilty based on the fact that you were arrested and locked up. It's like the court scene in Idiocracy.

Who will they send to jail for life when a corporations like Microsoft, Apple, Adobe, Oracle, Google, Mozilla release known buggy and insecure software to get it out the door and patch later? That sure in hell is national security issue.

Any "act on a computer" consumes electricity, hence damages the environment. And any web-site I visit has not specifically "authorized" me to do so, so in some sense it is "unauthorized" (yet usually welcome). Pretty nifty. I guess they want to rescue the collapsing British economy by creating a huge prison industry.

Maybe first time offenders could have their eyes gouged out? Or finger nails pulled out with pliers.Maybe electroshock treatment if they are under age, because sending a 13 year old for life in prison is quite a bit different than sending a 33 year old for life in prison.

If they deface the website of a prominent person, then tar and feathers or ride them out on a rail. Both of those persisted into the modern era in the US, I don't see why the UK can't reuse old practices.

So it's basically carte blanche for anyone with a job in in politics, law enforcement, or prosecution to destroy the life of anyone they choose, based on nothing more than conjecture. Does anyone else find this frightening? Would the dangers of this idea be more obvious if the words "computer users" or "hackers" were replaced with the word "people"?

So a government policy that was written by someone on a computer which resulted in damage to national security, the economy or the environment (hmm, there might be a few of those) can now result in life?